[BUG] A2A runtime task-store callbacks lose authenticated user context before task resolution

[erauner12]

📋 Prerequisites

• I have searched the existing issues to avoid creating a duplicate
• By submitting this issue, you agree to follow our Code of Conduct
• I am using the latest version of the software
• I have tried to clear cache/cookies or used incognito mode (if ui-related)
• I can consistently reproduce this issue

🎯 Affected Service(s)

App Service

🚦 Impact/Severity

Blocker

🐛 Bug Description

The Go A2A runtime extracts the authenticated user from inbound x-user-id
request metadata and stores it in CallContext.User, but the call interceptor
returns the original request context without that identity.

Pre-executor task resolution and task-store persistence callbacks obtain the
user from the returned context.Context, not from CallContext.User. Those
callbacks can therefore run without the authenticated request identity and fall
back to the runtime service identity for owner-scoped task access.

This is especially significant for persisted input-required tasks. A later
A2A continuation is a new request and may be handled by a different process, so
each request must reconstruct and propagate its authenticated identity before
stored-task resolution occurs.

🔄 Steps To Reproduce

1. On current main, construct an A2A CallContext whose service parameters
   contain a non-empty x-user-id value.
2. Call UserIDCallInterceptor().Before(...) with that context.
3. Observe that CallContext.User contains the authenticated user.
4. Inspect the returned context.Context with auth.UserIDFromContext(...).
5. Observe that the returned context does not contain the user identity.
6. Source inspection shows that when the returned context is subsequently passed
   to KAgentTaskStore, ControllerClient.CallContext cannot add x-user-id to
   the owner-scoped controller call.

🤔 Expected Behavior

The A2A call interceptor should preserve the authenticated request identity in
both CallContext.User and the returned context.Context.

Pre-executor task resolution and persistence callbacks should therefore access
the authoritative task store using the same authenticated identity as the
current A2A request.

📱 Actual Behavior

Only CallContext.User is populated. The returned request context is unchanged,
so auth.UserIDFromContext(returnedCtx) is empty before executor processing.

Task-store callbacks that run before the executor attaches identity can
therefore use the runtime service identity rather than the authenticated A2A
request identity.

💻 Environment

• OS and version: Not environment-specific
• Kubernetes version/provider: Not applicable to the source-level reproduction
• Browser: Not applicable
• Application version: current main inspected at bc92b6850b4e1342fd6b9483961aa163ece94836
• Affected component: Go ADK A2A runtime and controller-backed task store

🔧 CLI Bug Report

Not applicable. The issue is deterministically reproduced at the interceptor
and task-store context boundary.

🔍 Additional Context

The existing components already support the required behavior:

• controller-v2 carries upstream authentication headers in A2A service parameters;
• the runtime interceptor reads x-user-id and populates CallContext.User;
• controller clients emit x-user-id when the user identity is present in their
  input context;
• task reads and writes are owner-scoped.

The missing connection is preserving the authenticated user in the context
returned by the call interceptor before task resolution and persistence
callbacks execute. This does not require a new identity source, authentication
mode, header, or trust policy.

This issue isolates the current runtime identity-lifecycle defect from the
legacy controller task-query behavior tracked in #2464.

Focused regression coverage should assert that the interceptor populates both
CallContext.User and auth.UserIDFromContext(returnedCtx) from the same
inbound authenticated request.

📋 Logs

CallContext.User.Name: <authenticated-user>
auth.UserIDFromContext(returnedCtx): ""

📷 Screenshots

No response

🙋 Are you willing to contribute?

• I am willing to submit a PR to fix this issue

[erauner12]

Implementation draft: erauner12/kagent#11

The draft preserves the authenticated user from the current A2A request in both CallContext.User and the context returned by the runtime interceptor, with focused regression coverage for that boundary.

Related legacy controller task-query behavior remains tracked separately in #2464. No live current-main validation is claimed here.